search

palantir / conjure-java-runtime

Opinionated libraries for HTTP&JSON-based RPC using Dialogue, Feign, OkHttp as clients and Jetty/Jersey as servers
Apache License 2.0
79 stars 95 forks source link

CipherSuites should prioritise faster suites on Java11 #956

Open iamdanfox opened 5 years ago

iamdanfox commented 5 years ago

Current world

Currently, CipherSuites.java contains an ordered list of 'fastCipherSuites'. This has been hand tuned for Java8, but doesn't take advantage of the fast new CPU instructions on newer JVMs.

This means that as we move to Java11, we're leaving performance on the table (an internal benchmark shows TLS_RSA_WITH_AES_128_GCM_SHA256 coming out on top, but this is right at the bottom of our list!)

Proposal

Ensure CipherSuites returns suites fastest first, automatically detecting Java8 or Java11.

(Example output from an internal benchmark)

Benchmark JDK (cipher) Score Error Units
sendOneMegabyte 11.0.1 TLS_RSA_WITH_AES_128_GCM_SHA256 352.28 3.21 MiB/s
sendOneMegabyte 11.0.1 TLS_RSA_WITH_AES_256_GCM_SHA384 345.29 2.44 MiB/s
sendOneMegabyte 11.0.1 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 260.97 5.7 MiB/s
sendOneMegabyte 11.0.1 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 230.26 1.39 MiB/s
sendOneMegabyte 11.0.1 TLS_RSA_WITH_AES_128_CBC_SHA256 228.43 3.15 MiB/s
sendOneMegabyte 11.0.1 TLS_RSA_WITH_AES_256_CBC_SHA256 220.38 2.18 MiB/s
sendOneMegabyte 1.8.0_192 TLS_RSA_WITH_AES_128_CBC_SHA 187.2 1.36 MiB/s
sendOneMegabyte 11.0.1 TLS_RSA_WITH_AES_128_CBC_SHA 182.45 3.42 MiB/s
sendOneMegabyte 11.0.1 TLS_RSA_WITH_AES_256_CBC_SHA 180.7 1.89 MiB/s
sendOneMegabyte 1.8.0_192 TLS_RSA_WITH_AES_256_CBC_SHA 176.09 2.19 MiB/s
sendOneMegabyte 1.8.0_192 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 164.35 5.11 MiB/s
sendOneMegabyte 1.8.0_192 TLS_RSA_WITH_AES_128_CBC_SHA256 131.06 2.47 MiB/s
sendOneMegabyte 1.8.0_192 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 130.47 2.93 MiB/s
sendOneMegabyte 1.8.0_192 TLS_RSA_WITH_AES_256_CBC_SHA256 127.47 0.97 MiB/s
sendOneMegabyte 1.8.0_192 TLS_RSA_WITH_AES_128_GCM_SHA256 59.77 1.23 MiB/s
sendOneMegabyte 1.8.0_192 TLS_RSA_WITH_AES_256_GCM_SHA384 58.83 0.87 MiB/s

cc @dansanduleac

carterkozak commented 5 years ago

TLS_RSA_WITH_AES_128_GCM_SHA256 and TLS_RSA_WITH_AES_256_GCM_SHA384 both result in 900-1000 MiB/s using Conscrypt, which is also available for java 8. We currently don't provide any mechanism to opt into Conscrypt for clients, only servers.

stale[bot] commented 5 years ago

This issue has been automatically marked as stale because it has not been touched in the last 60 days. Please comment if you'd like to keep it open, otherwise it'll be closed in 7 days time.